The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using vipsthumbnail and suggested parallelization via find and xargs to process large batches of images.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted filenames from local directories and interpolates these paths directly into shell command templates. This presents a potential command injection surface if the filesystem contains maliciously named files (e.g., using shell metacharacters like ;, &, or backticks).
Ingestion points: Reads filenames from an input directory provided by the user or discovered on the filesystem (referenced in SKILL.md).
Boundary markers: The procedure documentation suggests wrapping variables in double quotes in the shell examples, which provides some mitigation but does not prevent all injection vectors.
Capability inventory: The skill uses subprocess execution for vipsthumbnail and shell utilities like find and xargs.
Sanitization: There is no explicit instruction for the agent to sanitize or escape shell metacharacters beyond the provided quoting example.

fast-thumbnail